CVE-2026-18849

published 2026-08-19

CVE-2026-18849: IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level…

Priority P3 37 medium 6.8 CVSS 3.1

AV A AC L PR H UI N S U C H I H A H

IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
ibm	openbmc	FW1060.00 – FW1060.80	—
ibm	openbmc	fw1060.00 – fw1060.80	—
ibm	power_system_e1050_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_l1022_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_l1024_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_s1012_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_s1014_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_s1022_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_s1022s_firmware	>= fw1060.00 < fw1060.81	fw1060.81
ibm	power_system_s1024_firmware	>= fw1060.00 < fw1060.81	fw1060.81

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22